Because the law is poorly drafted, ill-conceived, and places the responsibility for protecting these data solely on third parties, who then do not have resources to determine if they are even allowed to do something that you already agreed to in another form (by providing the data, specifically for the purposes of publishing, as part of the necessary process of registering a domain).